René's URL Explorer Experiment


Title: Issue 42967: [CVE-2021-23336] urllib.parse.parse_qsl(): Web cache poisoning - `; ` as a query args separator - Python tracker

Mail addresses
report@bugs.python.org
kenjin4096@gmail.com
report@bugs.python.org

direct link

Domain: bugs.python.org

Nonetext/html; charset=utf-8

Links:

https://bugs.python.org/
Python Homehttps://www.python.org/
Abouthttps://www.python.org/about/
Newshttps://www.python.org/blogs/
Documentationhttps://www.python.org/doc/
Downloadshttps://www.python.org/downloads/
Communityhttps://www.python.org/community/
Foundationhttps://www.python.org/psf/
Developer's Guidehttps://devguide.python.org/
Issue Trackerhttps://bugs.python.org/
Searchhttps://bugs.python.org/issue?@template=search&status=1
Random Issuehttps://bugs.python.org/issue?@action=random
Issues with patchhttps://bugs.python.org/issue?status=1&@sort=-activity&@columns=id%2Cgithub%2Cactivity%2Ctitle%2Ccreator%2Cstatus&@dispname=Issues%20with%20patch&@startwith=0&@group=priority&keywords=2&@action=search&@filter=&@pagesize=50
Easy issueshttps://bugs.python.org/issue?status=1&@sort=-activity&@columns=id%2Cgithub%2Cactivity%2Ctitle%2Ccreator%2Cstatus&@dispname=Easy%20issues&@startwith=0&@group=priority&keywords=6&@action=search&@filter=&@pagesize=50
Statshttps://bugs.python.org/issue?@template=stats
Lost your login?https://bugs.python.org/user?@template=forgotten
User Listhttps://bugs.python.org/user?@sort=username
Committer Listhttps://bugs.python.org/user?iscommitter=1&@action=search&@sort=username&@pagesize=300
Tracker Documentationhttp://docs.python.org/devguide/triaging.html
Tracker Developmenthttp://wiki.python.org/moin/TrackerDevelopment
Report Tracker Problemhttps://github.com/python/psf-infra-meta/issues
https://github.com/python/cpython/issues
GitHubhttps://github.com/python/cpython/issues
see the GitHub FAQs in the Python's Developer Guide.https://devguide.python.org/gh-faq/
This issue has been migrated to GitHub: https://github.com/python/cpython/issues/87133 https://github.com/python/cpython/issues/87133
Titlehttp://docs.python.org/devguide/triaging.html#title
Typehttp://docs.python.org/devguide/triaging.html#type
Stagehttp://docs.python.org/devguide/triaging.html#stage
Componentshttp://docs.python.org/devguide/triaging.html#components
Versionshttp://docs.python.org/devguide/triaging.html#versions
Statushttp://docs.python.org/devguide/triaging.html#status
Resolutionhttp://docs.python.org/devguide/triaging.html#resolution
Dependencieshttp://docs.python.org/devguide/triaging.html#dependencies
Supersederhttp://docs.python.org/devguide/triaging.html#superseder
Assigned Tohttp://docs.python.org/devguide/triaging.html#assigned-to
Nosy Listhttp://docs.python.org/devguide/triaging.html#nosy-list
Priorityhttp://docs.python.org/devguide/triaging.html#priority
Keywordshttp://docs.python.org/devguide/triaging.html#keywords
CVE-2021-23336-only-amp-as-query-sep.patchhttps://bugs.python.org/file49839/CVE-2021-23336-only-amp-as-query-sep.patch
PR 24271https://github.com/python/cpython/pull/24271
PR 24297https://github.com/python/cpython/pull/24297
PR 24528https://github.com/python/cpython/pull/24528
PR 24529https://github.com/python/cpython/pull/24529
PR 24531https://github.com/python/cpython/pull/24531
PR 24532https://github.com/python/cpython/pull/24532
PR 24536https://github.com/python/cpython/pull/24536
PR 24818https://github.com/python/cpython/pull/24818
PR 25344https://github.com/python/cpython/pull/25344
PR 25345https://github.com/python/cpython/pull/25345
msg385266https://bugs.python.org/issue42967#msg385266
(view)https://bugs.python.org/msg385266
https://github.com/python/cpython/blob/master/Lib/urllib/parse.py#L739https://github.com/python/cpython/blob/master/Lib/urllib/parse.py#L739
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
http://google.comhttp://google.com
http://google.comhttp://google.com
https://github.com/pallets/werkzeug/blob/6784c44673d25c91613c6bf2e614c84465ad135b/src/werkzeug/urls.py#L833https://github.com/pallets/werkzeug/blob/6784c44673d25c91613c6bf2e614c84465ad135b/src/werkzeug/urls.py#L833
msg385332https://bugs.python.org/issue42967#msg385332
(view)https://bugs.python.org/msg385332
bpo-42975https://bugs.python.org/issue42975
https://www.w3.org/TR/2014/REC-html5-20141028/forms.html#url-encoded-form-datahttps://www.w3.org/TR/2014/REC-html5-20141028/forms.html#url-encoded-form-data
msg385337https://bugs.python.org/issue42967#msg385337
(view)https://bugs.python.org/msg385337
https://www.w3.org/TR/1999/REC-html401-19991224/appendix/notes.html#h-B.2.2https://www.w3.org/TR/1999/REC-html401-19991224/appendix/notes.html#h-B.2.2
https://www.w3.org/TR/1999/REC-html401-19991224/interact/forms.html#h-17.13.4.1https://www.w3.org/TR/1999/REC-html401-19991224/interact/forms.html#h-17.13.4.1
msg385341https://bugs.python.org/issue42967#msg385341
(view)https://bugs.python.org/msg385341
msg385342https://bugs.python.org/issue42967#msg385342
(view)https://bugs.python.org/msg385342
msg385344https://bugs.python.org/issue42967#msg385344
(view)https://bugs.python.org/msg385344
msg385346https://bugs.python.org/issue42967#msg385346
(view)https://bugs.python.org/msg385346
msg385352https://bugs.python.org/issue42967#msg385352
(view)https://bugs.python.org/msg385352
msg385495https://bugs.python.org/issue42967#msg385495
(view)https://bugs.python.org/msg385495
PR 2https://github.com/python/cpython/pull/2
https://github.com/python/cpython/pull/24271https://github.com/python/cpython/pull/24271
msg385496https://bugs.python.org/issue42967#msg385496
(view)https://bugs.python.org/msg385496
PR 2https://github.com/python/cpython/pull/2
https://github.com/python/cpython/pull/24271https://github.com/python/cpython/pull/24271
https://bugs.python.org/issue42967https://bugs.python.org/issue42967
msg385497https://bugs.python.org/issue42967#msg385497
(view)https://bugs.python.org/msg385497
msg385513https://bugs.python.org/issue42967#msg385513
(view)https://bugs.python.org/msg385513
https://bugs.debian.org/cgi-bin/pkgreport.cgi?archive=both;package=gtk3-engines-xfce;package=gtk2-engines-xfcehttps://bugs.debian.org/cgi-bin/pkgreport.cgi?archive=both;package=gtk3-engines-xfce;package=gtk2-engines-xfce
msg385527https://bugs.python.org/issue42967#msg385527
(view)https://bugs.python.org/msg385527
msg385544https://bugs.python.org/issue42967#msg385544
(view)https://bugs.python.org/msg385544
msg385549https://bugs.python.org/issue42967#msg385549
(view)https://bugs.python.org/msg385549
msg385565https://bugs.python.org/issue42967#msg385565
(view)https://bugs.python.org/msg385565
msg385566https://bugs.python.org/issue42967#msg385566
(view)https://bugs.python.org/msg385566
msg385567https://bugs.python.org/issue42967#msg385567
(view)https://bugs.python.org/msg385567
msg385582https://bugs.python.org/issue42967#msg385582
(view)https://bugs.python.org/msg385582
msg385585https://bugs.python.org/issue42967#msg385585
(view)https://bugs.python.org/msg385585
msg385590https://bugs.python.org/issue42967#msg385590
(view)https://bugs.python.org/msg385590
msg385865https://bugs.python.org/issue42967#msg385865
(view)https://bugs.python.org/msg385865
msg386003https://bugs.python.org/issue42967#msg386003
(view)https://bugs.python.org/msg386003
msg386785https://bugs.python.org/issue42967#msg386785
(view)https://bugs.python.org/msg386785
msg386787https://bugs.python.org/issue42967#msg386787
(view)https://bugs.python.org/msg386787
msg386788https://bugs.python.org/issue42967#msg386788
(view)https://bugs.python.org/msg386788
msg386954https://bugs.python.org/issue42967#msg386954
(view)https://bugs.python.org/msg386954
https://github.com/python/cpython/pull/24297https://github.com/python/cpython/pull/24297
msg386957https://bugs.python.org/issue42967#msg386957
(view)https://bugs.python.org/msg386957
msg386960https://bugs.python.org/issue42967#msg386960
(view)https://bugs.python.org/msg386960
msg386968https://bugs.python.org/issue42967#msg386968
(view)https://bugs.python.org/msg386968
fcbe0cb04d35189401c0c880ebfb4311e952d776https://hg.python.org/lookup/fcbe0cb04d35189401c0c880ebfb4311e952d776
bpo-42967https://bugs.python.org/issue42967
#24297https://bugs.python.org/issue24297
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776
msg386980https://bugs.python.org/issue42967#msg386980
(view)https://bugs.python.org/msg386980
msg387027https://bugs.python.org/issue42967#msg387027
(view)https://bugs.python.org/msg387027
a2f0654b0a5b4c4f726155620002cc1f5f2d206ahttps://hg.python.org/lookup/a2f0654b0a5b4c4f726155620002cc1f5f2d206a
bpo-42967https://bugs.python.org/issue42967
GH-24536https://github.com/python/cpython/pull/24536
https://github.com/python/cpython/commit/a2f0654b0a5b4c4f726155620002cc1f5f2d206ahttps://github.com/python/cpython/commit/a2f0654b0a5b4c4f726155620002cc1f5f2d206a
msg387037https://bugs.python.org/issue42967#msg387037
(view)https://bugs.python.org/msg387037
c9f07813ab8e664d8c34413c4fc2d4f86c061a92https://hg.python.org/lookup/c9f07813ab8e664d8c34413c4fc2d4f86c061a92
bpo-42967https://bugs.python.org/issue42967
GH-24297https://github.com/python/cpython/pull/24297
#24528https://bugs.python.org/issue24528
https://github.com/python/cpython/commit/c9f07813ab8e664d8c34413c4fc2d4f86c061a92https://github.com/python/cpython/commit/c9f07813ab8e664d8c34413c4fc2d4f86c061a92
msg387039https://bugs.python.org/issue42967#msg387039
(view)https://bugs.python.org/msg387039
e3110c3cfbb7daa690d54d0eff6c264c870a71bfhttps://hg.python.org/lookup/e3110c3cfbb7daa690d54d0eff6c264c870a71bf
bpo-42967https://bugs.python.org/issue42967
GH-24297https://github.com/python/cpython/pull/24297
#24529https://bugs.python.org/issue24529
https://github.com/python/cpython/commit/e3110c3cfbb7daa690d54d0eff6c264c870a71bfhttps://github.com/python/cpython/commit/e3110c3cfbb7daa690d54d0eff6c264c870a71bf
msg387040https://bugs.python.org/issue42967#msg387040
(view)https://bugs.python.org/msg387040
d0d4d30882fe3ab9b1badbecf5d15d94326fd13ehttps://hg.python.org/lookup/d0d4d30882fe3ab9b1badbecf5d15d94326fd13e
bpo-42967https://bugs.python.org/issue42967
GH-24297https://github.com/python/cpython/pull/24297
GH-24531https://github.com/python/cpython/pull/24531
https://github.com/python/cpython/commit/d0d4d30882fe3ab9b1badbecf5d15d94326fd13ehttps://github.com/python/cpython/commit/d0d4d30882fe3ab9b1badbecf5d15d94326fd13e
msg387045https://bugs.python.org/issue42967#msg387045
(view)https://bugs.python.org/msg387045
5c17dfc5d70ce88be99bc5769b91ce79d7a90d61https://hg.python.org/lookup/5c17dfc5d70ce88be99bc5769b91ce79d7a90d61
bpo-42967https://bugs.python.org/issue42967
GH-24297https://github.com/python/cpython/pull/24297
GH-24532https://github.com/python/cpython/pull/24532
https://github.com/python/cpython/commit/5c17dfc5d70ce88be99bc5769b91ce79d7a90d61https://github.com/python/cpython/commit/5c17dfc5d70ce88be99bc5769b91ce79d7a90d61
msg387049https://bugs.python.org/issue42967#msg387049
(view)https://bugs.python.org/msg387049
msg387069https://bugs.python.org/issue42967#msg387069
(view)https://bugs.python.org/msg387069
https://python-security.readthedocs.io/vuln/urllib-query-string-semicolon-separator.htmlhttps://python-security.readthedocs.io/vuln/urllib-query-string-semicolon-separator.html
msg387638https://bugs.python.org/issue42967#msg387638
(view)https://bugs.python.org/msg387638
msg387712https://bugs.python.org/issue42967#msg387712
(view)https://bugs.python.org/msg387712
msg387735https://bugs.python.org/issue42967#msg387735
(view)https://bugs.python.org/msg387735
msg387756https://bugs.python.org/issue42967#msg387756
(view)https://bugs.python.org/msg387756
msg388368https://bugs.python.org/issue42967#msg388368
(view)https://bugs.python.org/msg388368
msg388433https://bugs.python.org/issue42967#msg388433
(view)https://bugs.python.org/msg388433
urllib/parse.pyhttps://github.com/python/cpython/blob/main/Lib/urllib/parse.py#L695
urllib/parse.pyhttps://github.com/python/cpython/blob/main/Lib/urllib/parse.py#L748
msg388434https://bugs.python.org/issue42967#msg388434
(view)https://bugs.python.org/msg388434
msg388440https://bugs.python.org/issue42967#msg388440
(view)https://bugs.python.org/msg388440
msg388447https://bugs.python.org/issue42967#msg388447
(view)https://bugs.python.org/msg388447
https://www.w3.org/TR/html401/appendix/notes.html#ampersands-in-urishttps://www.w3.org/TR/html401/appendix/notes.html#ampersands-in-uris
msg388486https://bugs.python.org/issue42967#msg388486
(view)https://bugs.python.org/msg388486
msg388574https://bugs.python.org/issue42967#msg388574
(view)https://bugs.python.org/msg388574
msg390782https://bugs.python.org/issue42967#msg390782
(view)https://bugs.python.org/msg390782
b38601d49675d90e1ee6faa47f7adaeca992d02dhttps://hg.python.org/lookup/b38601d49675d90e1ee6faa47f7adaeca992d02d
bpo-42967https://bugs.python.org/issue42967
#24818https://bugs.python.org/issue24818
https://github.com/python/cpython/commit/b38601d49675d90e1ee6faa47f7adaeca992d02dhttps://github.com/python/cpython/commit/b38601d49675d90e1ee6faa47f7adaeca992d02d
msg390784https://bugs.python.org/issue42967#msg390784
(view)https://bugs.python.org/msg390784
6ec2fb42f93660810952388e5c4018c197c17c8chttps://hg.python.org/lookup/6ec2fb42f93660810952388e5c4018c197c17c8c
bpo-42967https://bugs.python.org/issue42967
GH-24818https://github.com/python/cpython/pull/24818
https://github.com/python/cpython/commit/6ec2fb42f93660810952388e5c4018c197c17c8chttps://github.com/python/cpython/commit/6ec2fb42f93660810952388e5c4018c197c17c8c
msg390790https://bugs.python.org/issue42967#msg390790
(view)https://bugs.python.org/msg390790
msg391231https://bugs.python.org/issue42967#msg391231
(view)https://bugs.python.org/msg391231
d5b80eb11b4812b4a579ce129ba4a10c5f5d27f6https://hg.python.org/lookup/d5b80eb11b4812b4a579ce129ba4a10c5f5d27f6
bpo-42967https://bugs.python.org/issue42967
GH-24818https://github.com/python/cpython/pull/24818
#25345https://bugs.python.org/issue25345
https://github.com/python/cpython/commit/d5b80eb11b4812b4a579ce129ba4a10c5f5d27f6https://github.com/python/cpython/commit/d5b80eb11b4812b4a579ce129ba4a10c5f5d27f6
msg405721https://bugs.python.org/issue42967#msg405721
(view)https://bugs.python.org/msg405721
msg405723https://bugs.python.org/issue42967#msg405723
(view)https://bugs.python.org/msg405723
msg405725https://bugs.python.org/issue42967#msg405725
(view)https://bugs.python.org/msg405725
bpo-12168https://bugs.python.org/issue12168
msg405728https://bugs.python.org/issue42967#msg405728
(view)https://bugs.python.org/msg405728
vstinnerhttps://bugs.python.org/user2377
msg405728https://bugs.python.org/msg405728
msg405725https://bugs.python.org/msg405725
msg405723https://bugs.python.org/msg405723
erlendaaslandhttps://bugs.python.org/user31937
msg405721https://bugs.python.org/msg405721
vstinnerhttps://bugs.python.org/user2377
ned.deilyhttps://bugs.python.org/user5248
pablogsalhttps://bugs.python.org/user26865
serhiy.storchakahttps://bugs.python.org/user15623
miss-islingtonhttps://bugs.python.org/user27838
mceplhttps://bugs.python.org/user5290
petr.viktorinhttps://bugs.python.org/user9942
rschironhttps://bugs.python.org/user31501
eric.araujohttps://bugs.python.org/user7641
lemburghttps://bugs.python.org/user4
gregory.p.smithhttps://bugs.python.org/user252
kjhttps://bugs.python.org/user35958
orsenthilhttps://bugs.python.org/user1741
AdamGoldhttps://bugs.python.org/user37321
ahmedsayeed1982https://bugs.python.org/user40940
msg405709https://bugs.python.org/msg405709
ahmedsayeed1982https://bugs.python.org/user40940
lemburghttps://bugs.python.org/user4
gregory.p.smithhttps://bugs.python.org/user252
orsenthilhttps://bugs.python.org/user1741
vstinnerhttps://bugs.python.org/user2377
ned.deilyhttps://bugs.python.org/user5248
mceplhttps://bugs.python.org/user5290
eric.araujohttps://bugs.python.org/user7641
petr.viktorinhttps://bugs.python.org/user9942
serhiy.storchakahttps://bugs.python.org/user15623
miss-islingtonhttps://bugs.python.org/user27838
rschironhttps://bugs.python.org/user31501
kjhttps://bugs.python.org/user35958
AdamGoldhttps://bugs.python.org/user37321
msg405709https://bugs.python.org/msg405709
msg391231https://bugs.python.org/msg391231
msg390790https://bugs.python.org/msg390790
msg390784https://bugs.python.org/msg390784
pull_request24079https://bugs.python.org/pull_request24079
miss-islingtonhttps://bugs.python.org/user27838
pull_request24078https://bugs.python.org/pull_request24078
msg390782https://bugs.python.org/msg390782
msg388574https://bugs.python.org/msg388574
msg388486https://bugs.python.org/msg388486
msg388447https://bugs.python.org/msg388447
msg388440https://bugs.python.org/msg388440
pull_request23584https://bugs.python.org/pull_request23584
msg388434https://bugs.python.org/msg388434
petr.viktorinhttps://bugs.python.org/user9942
msg388433https://bugs.python.org/msg388433
rschironhttps://bugs.python.org/user31501
msg388368https://bugs.python.org/msg388368
msg387756https://bugs.python.org/msg387756
CVE-2021-23336-only-amp-as-query-sep.patchhttps://bugs.python.org/file49839
msg387735https://bugs.python.org/msg387735
mceplhttps://bugs.python.org/user5290
msg387712https://bugs.python.org/msg387712
gregory.p.smithhttps://bugs.python.org/user252
msg387638https://bugs.python.org/msg387638
msg387069https://bugs.python.org/msg387069
msg387049https://bugs.python.org/msg387049
msg387045https://bugs.python.org/msg387045
msg387040https://bugs.python.org/msg387040
msg387039https://bugs.python.org/msg387039
msg387037https://bugs.python.org/msg387037
msg387027https://bugs.python.org/msg387027
pull_request23323https://bugs.python.org/pull_request23323
msg386980https://bugs.python.org/msg386980
pull_request23319https://bugs.python.org/pull_request23319
pull_request23318https://bugs.python.org/pull_request23318
pull_request23316https://bugs.python.org/pull_request23316
pull_request23315https://bugs.python.org/pull_request23315
msg386968https://bugs.python.org/msg386968
msg386960https://bugs.python.org/msg386960
msg386957https://bugs.python.org/msg386957
msg386954https://bugs.python.org/msg386954
msg386788https://bugs.python.org/msg386788
msg386787https://bugs.python.org/msg386787
msg386785https://bugs.python.org/msg386785
orsenthilhttps://bugs.python.org/user1741
msg386003https://bugs.python.org/msg386003
ned.deilyhttps://bugs.python.org/user5248
lukasz.langahttps://bugs.python.org/user12704
msg385865https://bugs.python.org/msg385865
msg385590https://bugs.python.org/msg385590
msg385585https://bugs.python.org/msg385585
msg385582https://bugs.python.org/msg385582
msg385567https://bugs.python.org/msg385567
msg385566https://bugs.python.org/msg385566
msg385565https://bugs.python.org/msg385565
msg385549https://bugs.python.org/msg385549
msg385544https://bugs.python.org/msg385544
msg385527https://bugs.python.org/msg385527
eric.araujohttps://bugs.python.org/user7641
msg385513https://bugs.python.org/msg385513
msg385497https://bugs.python.org/msg385497
msg385496https://bugs.python.org/msg385496
msg385495https://bugs.python.org/msg385495
pull_request23120https://bugs.python.org/pull_request23120
orsenthilhttps://bugs.python.org/user1741
msg385352https://bugs.python.org/msg385352
patchhttps://bugs.python.org/keyword2
kjhttps://bugs.python.org/user35958
pull_request23094https://bugs.python.org/pull_request23094
msg385346https://bugs.python.org/msg385346
serhiy.storchakahttps://bugs.python.org/user15623
msg385344https://bugs.python.org/msg385344
msg385342https://bugs.python.org/msg385342
msg385341https://bugs.python.org/msg385341
lemburghttps://bugs.python.org/user4
msg385337https://bugs.python.org/msg385337
vstinnerhttps://bugs.python.org/user2377
msg385332https://bugs.python.org/msg385332
issue42975 supersederhttps://bugs.python.org/issue42975
The Python Software Foundationhttps://python.org/psf-landing/
Rounduphttp://roundup.sourceforge.net
Python Software Foundationhttp://python.org/psf
Legal Statementshttp://python.org/about/legal
URLs of crawlers that visited me.